Power-on initialization method of full-autonomous flight spacecraft

Abstract

The invention discloses a power-on initialization method for a full-autonomous flight spacecraft, and the method comprises the steps: enabling system software to enter a safety configuration mode to set all important state parameters when a central computer is powered on and fails to communicate with lower computers; in the autonomous flight period of the spacecraft, when a center computer has a fault of reset restart or power failure restart, if the center computer can read important data from a lower computer, system software of the center computer enters a reset generator tripping mode, and various important state parameters are set according to the reset generator tripping mode; when the whole satellite is powered off and powered on instantly, important parameters of the lower computer are all lost, communication between the central computer and the lower computer is normal, important data cannot be read from the lower computer, and self FALSH important data are successfully read, a whole satellite power-down mode is entered, and various important state parameters are set accordingly; and if the reading of the own FLASH important data fails, entering a whole satellite power-down and important data invalid mode to set various important state parameters.

Description

Technical Field

[0001] The invention relates to a power-on initialization method for a fully autonomous flying spacecraft, and belongs to the field of satellite electronics. Background Art

[0002] With the large-scale application of all-electric propulsion spacecraft, due to the small thrust of its thruster, it takes several months for the spacecraft to enter orbit, in order to transfer from 200 kilometers at perigee to the geostationary orbit 36,000 kilometers away from the earth. This process takes more than 180 days. The attitude and trajectory of the spacecraft need to be continuously corrected during the orbit change until the orbit change is completed. To ensure the thrust direction and energy requirements of the electric propulsion orbit change, the attitude of the spacecraft cannot guarantee the ground measurement and control direction during the orbit change. During the spacecraft transfer orbit, the ground measurement and control station of the spacecraft cannot be measured and controlled for a long time. Therefore, it is necessary to require the spacecraft to have fully autonomous flight capabilities and autonomous fault handling capabilities.

[0003] The spacecraft center computer is the "brain" of the spacecraft. When the spacecraft system is in the invisible arc segment, once a reset, power-off restart or other failure occurs, its computer system needs to restore the spacecraft status to the maximum extent according to the spacecraft orbit situation, orbit change stage, important data before power failure, etc., to ensure the safety of the spacecraft itself and to continue to complete the autonomous flight mission as much as possible. At present, the traditional spacecraft orbit change process has the following problems:

[0004] 1) When the system resets or loses power, the autonomous orbit change stops and ground intervention is required to complete the next task, which affects the efficiency of the spacecraft's autonomous orbit change;

[0005] 2) When a traditional spacecraft is in the process of autonomous orbit change, if the system is restarted, the system initialization execution process is generally consistent, and different system initialization schemes are not adopted, resulting in the inability to personalize the handling of different power-off conditions, and the system cannot be smoothly connected before and after the failure. Summary of the invention

[0006] The technical problem solved by the present invention is: to overcome the deficiencies of the prior art, to provide a power-on initialization method for a fully autonomous flying spacecraft, to achieve autonomous orbit change operation of the spacecraft system and smooth connection before and after system failure without human intervention.

[0007] The technical solution of the present invention is: a power-on initialization method for a fully autonomous flying spacecraft, comprising:

[0008] When the spacecraft is tested on the ground, after the spacecraft system is powered on for the first time, the central computer fails to communicate with the lower computers after powering on, and the system software of the central computer enters the safe configuration mode, and various important status parameters are set accordingly;

[0009] During the autonomous flight of the spacecraft, when the central computer is reset and restarted, or powered off and restarted, and all the slave computers are powered on and operating normally before the central computer is restarted, if the central computer can read important data from the slave computers, the system software of the central computer enters the reset and cut-off mode, and sets various important status parameters accordingly;

[0010] During the autonomous flight of the spacecraft, when the whole satellite has a power failure and then power on again, all the important parameters of the lower computer are lost. The central computer communicates with the lower computer normally but cannot read important data from it. When the reading of its own FALSH important data is successful, the system software of the central computer enters the whole satellite power-off mode, and sets various important status parameters accordingly.

[0011] During the autonomous flight of the spacecraft, if the entire satellite experiences a momentary power outage and power-on failure, all important parameters of the lower computer are lost. The central computer can communicate with the lower computer but cannot read important data, and fails to read its own FALSH important data. The system software of the central computer enters a power-off mode for the entire satellite and invalid important data, and various important status parameters are set accordingly.

[0012] Preferably, each lower computer includes: a power supply controller, a battery pack management unit, a control computer, and an integrated business unit.

[0013] Preferably, the important data read from each slave computer includes various important status parameters of the system, specifically:

[0014] Thermal control software enable status, energy software enable status, control software enable status, satellite time, FDIR enable status, autonomous flight enable status, communication status table with each lower computer, orbit mark, central computer write enable status to main backup FLASH, and whole satellite remote control clear and secret status.

[0015] Preferably, the system software of the central computer enters a safe configuration mode, and various important status parameters are set accordingly, specifically:

[0016] Do not read important data from the lower computer; the state parameters are set as follows:

[0017] Thermal control software enable / disable, energy software enable / disable, control software enable / disable, default satellite time, FDIR enable / disable, autonomous flight enable / disable, the communication status table with each lower device uses the master copy by default, the orbit mark defaults to the transfer orbit, the central computer cannot write to the main backup FLASH, and the entire satellite remote control defaults to the bright state.

[0018] Preferably, when the system software of the central computer enters the reset switching mode and various important status parameters are set accordingly, the central computer reads important data stored in the lower computer and overwrites various status parameters of the system software accordingly.

[0019] Preferably, the system software of the central computer enters the whole-satellite power-off mode, and when various important status parameters are set accordingly, the status setting is based on safety, specifically:

[0020] The thermal control software is configured in minimum energy mode, the energy software is configured in minimum mode, and the control system software enters the solar orientation mode;

[0021] Autonomous flight enable and disable, autonomous establishment of communication status table with each lower computer, central computer write enable to main backup FLASH, and whole satellite remote control setting clear state;

[0022] Restore important data recorded in its own FLASH, star time, FDIR enable, and orbit mark from FLASH.

[0023] Preferably, the system software of the central computer enters a mode where the entire satellite is powered off and important data is invalid, and various important status parameters are set accordingly, specifically:

[0024] The thermal control software is configured in minimum energy mode, the energy software is configured in minimum mode, and the control system software enters the sun-orientation mode;

[0025] The satellite time is set to the default satellite time, FDIR is enabled or disabled, autonomous flight is enabled or disabled, the orbit mark is set to transfer orbit, the central computer is enabled to write to the main backup FLASH, and the whole satellite remote control is set to the bright state;

[0026] The communication between the central computer and the lower computer is carried out by autonomously establishing the link result.

[0027] Compared with the prior art, the present invention has the following advantages:

[0028] (1) During autonomous flight, if the spacecraft of the present invention experiences a power failure, reset, or restart failure, the spacecraft system can autonomously recover to the state before the spacecraft failed based on its own orbital environment, orbit change stage, spacecraft attitude, and other information without ground intervention. The spacecraft can continue autonomous flight.

[0029] (2) Compared with traditional spacecraft, the system of the present invention divides the initialization program into four types of working conditions, and designs different initialization programs for different working conditions, so as to achieve a smooth connection before and after the system fails;

[0030] (3) The present invention can be extended to various occasions with extremely high reliability requirements, and can greatly improve the reliability and safety of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The system framework of the fully autonomous flying spacecraft of the present invention;

[0032] Figure 2 This is a power-on initialization flow chart for a fully autonomous flying spacecraft of the present invention. DETAILED DESCRIPTION

[0033] The electronic system of the fully autonomous flying spacecraft adopts a distributed structure, in which the upper computer is the central computer, and the lower computers are composed of: power controller, battery pack management unit, control computer, and integrated business unit. A distributed network system is built through the 1553B bus, providing standard bus interface and electrical interface to the outside world, realizing the spacecraft's satellite management, control and other comprehensive service functions.

[0034] The fully autonomous spacecraft mainly goes through the following important stages during the flight, including: active stage, rocket-satellite separation stage, chemical propulsion orbit change stage, electric propulsion orbit change stage, and synchronous orbit. The system performs different functions according to the different stages of the spacecraft. During the autonomous flight, the spacecraft system may experience reset, power failure and other fault conditions at any stage. This condition requires the system to be re-initialized and then restored to the software state before the power failure to continue autonomous flight.

[0035] 1 Power-down mode classification

[0036] A complete analysis is made based on the power-on sequence and initialization strategy under different faults. During the operation of the fully autonomous spacecraft, the power-on sequence after power-on and reset is analyzed. The system is required to have autonomous recovery capabilities under different working conditions, and perform autonomous fault processing and data recovery. If a system power outage occurs, after reset, ensure that the system can continue the relevant state before the power outage and restore important data.

[0037] Therefore, the initial state settings of the system are different in different stages and under different working conditions. According to the failure mode and system mission requirements, the initial state settings of the spacecraft system are divided into the following categories: safe configuration mode process, reset and cut-off process, whole satellite power-off process, power-off and restart with data unrecoverable process.

[0038] (1) Safety configuration mode: This process is designed to support the needs of ground-based spacecraft test mode. In order to prevent risks caused by incorrect operations on the energy, thermal control, and control subsystems of the spacecraft system, in this mode, the system initial state is set to safety configuration mode, that is, control functions are prohibited, thermal control functions are prohibited, energy management functions are prohibited, control and propulsion functions are prohibited, and the communication with the lower computer 1553B bus defaults to the master copy. Other states are set to wait for ground command control execution.

[0039] (2) Reset and cut-off mode: This mode is mainly used to identify and solve the faults of the upper computer (central computer) being reset and restarted, or power-off and restarting during the autonomous flight of the spacecraft. In this mode, the central computer can recover important data from each lower computer. The important data records the operating status of each functional software, the spacecraft operation stage, the task being executed and other parameters. The system can restore the status settings before the reset based on the important data.

[0040] (3) Whole-satellite power-off mode: This mode mainly solves the problem of system status setting after the whole satellite is powered off and then powered on. After the spacecraft system is powered off and then powered on, since all important parameters of the lower computer are lost, the system restores important data from FLASH. Due to the limited storage capacity of FLASH, the system status setting is based on safety. Among them, thermal control and energy are configured in minimum mode. If it is in the orbit change period, the control system will enter the solar orientation mode and wait for ground intervention.

[0041] (4) The whole satellite loses power and important data recovery fails: In this mode, the main purpose is to prevent the spacecraft from losing power under abnormal conditions and failing to recover important data. The system needs to judge the stage status based on the actual collected data, configure the system's minimum working mode, and wait for timely processing from the ground. In this mode, the system traverses communication with each lower computer, and the state table is set to be on duty with the lower computer with normal communication, establish communication status with the lower computer, set the energy control mode according to the satellite-rocket separation status, and the minimum power mode. In the visible arc segment, after ground intervention, the system is configured normally.

[0042] 2 Power-off mode recognition strategies:

[0043] When the spacecraft system is powered on for the first time, the software stores important data (stage mark, satellite-rocket separation signal mark, etc.) in FLASH according to the status of each hardware of the spacecraft;

[0044] (1) Safe configuration mode identification strategy: According to the system design, during ground testing, the entire satellite is powered on first, the central computer is automatically powered on, and after the spacecraft telemetry data is transmitted to the ground, the ground operator sends instructions through the central computer to power on each slave computer. According to the characteristics of the task flow, in the safe configuration mode, the first power-on will inevitably fail to communicate with each slave computer (composed of power controller, battery pack management unit, control computer, and integrated business unit) via the 1553B bus. This feature is unique. Therefore, if the system software determines that the central computer fails to communicate with each slave computer, the software enters the ground test mode by default.

[0045] (2) System reset and switch mode identification strategy: In this mode, after the central computer is reset, since the other slave computers are powered on and running normally before the upper computer is reset, the upper computer and each slave computer can communicate normally and restore important data. Therefore, the judgment criterion of this mode is: if the important data can be successfully restored from the slave computer after the central computer is powered on, it is considered that the software has entered the system reset and switch mode.

[0046] (3) Whole-satellite power-off pattern recognition strategy

[0047] According to the power-on sequence analysis of each single machine, the host computer has the longest startup time, that is, after the host computer is powered on and the software is running normally, the other lower machines are already working normally. After the central computer is powered on, since the other lower machines are in the powered-on state, the host computer and the lower machines can establish communication normally. However, since the whole satellite is powered off, the lower machine is powered off and then powered on (because the power switch is a magnetic latching relay), so there is no important data saved by the host computer inside the single machine. Therefore, the judgment criterion of this mode is: the communication between the host computer and the lower machine is normal, but the reading of important data of the lower machine fails.

[0048] (4) Identification strategy for the entire satellite when it loses power and the FLASH data is invalid

[0049] This mode is designed to prevent the system from being initialized when the important data stored in the FLASH of the upper computer itself fails. The judgment criteria of this mode are: the communication between the upper computer and the lower computer is normal, but the reading of the important data of the lower computer fails and the reading of its own FALSH important data fails.

[0050] 3 Software execution process under each process

[0051] (1) Security configuration mode execution;

[0052] Operations performed by the software: important data will not be restored, thermal control software is disabled, energy software is disabled, control software is disabled, default satellite time, FDIR (fault identification, isolation and recovery) is disabled, autonomous flight is disabled, the communication status table with each lower-level device uses the master copy by default, the orbit mark defaults to the transfer orbit, the central computer is disabled from writing to the main backup FLASH, and the entire satellite remote control defaults to the bright state. At this point, the safety configuration mode initialization program has been completed;

[0053] (2) Reset cutting process

[0054] Restore the important data stored in the lower computer, and cover the important status parameters of the relevant software managed by the system software accordingly (the important status parameters restored include: thermal control software enable status, energy software enable status, control software enable status, satellite time, FDIR enable status, autonomous flight enable status, communication status table with each lower computer, orbit mark, central computer write enable status to the main backup FLASH, and the whole satellite remote control clear and secret status). At this point, the reset and cutting process initialization program is completed.

[0055] (3) Whole-satellite power-off process

[0056] Restore the important data recorded in FLASH, and use the important data of FLASH to overwrite the parameters managed by the software (thermal control software is configured according to the minimum energy mode, energy software is configured according to the minimum mode, control system software enters the solar orientation mode, star time is restored according to the important data of FLASH, FDIR is enabled or disabled according to the important data restored according to the FLASH record, autonomous flight is enabled or disabled, communication status tables with each lower computer are independently established, orbit marks are restored from FLASH, central computer enables writing to the main backup FLASH, and the remote control of the entire satellite is set to the bright state). At this point, the power-off process of the entire satellite is completed.

[0057] The solar orientation mode refers to the state where the sailboard is facing the sun, ensuring that the system has sufficient energy.

[0058] (4) Process of whole satellite power failure and invalid FLASH data

[0059] In this mode, no important data can be recovered. The central computer implements the following strategy: the central computer communicates with the lower computer using the result of autonomously establishing a link, the thermal control software is configured in minimum energy mode, the energy software is configured in minimum mode, the control system software enters the solar orientation mode, the star time is set to the default star time, FDIR is enabled or disabled, autonomous flight is enabled or disabled, the orbit mark sets the transfer orbit, the central computer enables writing to the main backup FLASH, and the entire satellite remote control is set to the bright state.

[0060] The technical problem solved by the present invention is: during the autonomous flight of a spacecraft, if a power failure, reset, or restart occurs, the spacecraft system can autonomously recover to the state before the spacecraft failure based on its own orbital environment, orbit change stage, spacecraft attitude, and other information, and can continue to fly autonomously. After the system is powered on, the software uses characteristic parameters to identify different power failure categories of the spacecraft in real time. Different initialization programs are executed according to each power failure category, so as to restore the system state before the power failure as much as possible, and realize autonomous orbit change operation of the spacecraft system without human intervention.

[0061] Compared with traditional spacecraft, when the system resets or loses power, there is no need for ground intervention, and the system can continue to perform autonomous orbit change missions after restarting;

[0062] At the same time, compared with traditional spacecraft, the system divides the initialization program into four working conditions, and designs different initialization programs for different working conditions, so as to achieve a smooth connection before and after the system fails.

[0063] The contents not described in detail in the specification of the present invention belong to the prior art known to the professional and technical personnel in this field.

Claims

1. A power-on initialization method for a fully autonomous flying spacecraft, characterized in that include: When the spacecraft is tested on the ground, after the spacecraft system is powered on for the first time, the central computer fails to communicate with the lower computers after powering on, and the system software of the central computer enters the safe configuration mode, and various important status parameters are set accordingly; During the autonomous flight of the spacecraft, when the central computer is reset and restarted, or powered off and restarted, and all the slave computers are powered on and operating normally before the central computer is restarted, if the central computer can read important data from the slave computers, the system software of the central computer enters the reset and cut-off mode, and sets various important status parameters accordingly; During the autonomous flight of the spacecraft, when the whole satellite has a power failure and then power on again, all the important parameters of the lower computer are lost. The central computer communicates with the lower computer normally but cannot read important data from it. When the reading of its own FALSH important data is successful, the system software of the central computer enters the whole satellite power-off mode, and sets various important status parameters accordingly. During the autonomous flight of the spacecraft, if the entire satellite experiences a momentary power outage and power-on failure, all important parameters of the lower computer are lost. The central computer can communicate with the lower computer but cannot read important data, and fails to read its own FALSH important data. The system software of the central computer enters a power-off mode for the entire satellite and invalid important data, and various important status parameters are set accordingly.

2. The power-on initialization method of a fully autonomous flying spacecraft according to claim 1, characterized in that: Each lower computer includes: power controller, battery pack management unit, control computer, and integrated business unit.

3. The power-on initialization method of a fully autonomous flying spacecraft according to claim 1, characterized in that: The important data read from each slave computer include various important status parameters of the system, specifically: Thermal control software enable status, energy software enable status, control software enable status, satellite time, FDIR enable status, autonomous flight enable status, communication status table with each lower computer, orbit mark, central computer write enable status to main backup FLASH, and whole satellite remote control clear and secret status.

4. The power-on initialization method of a fully autonomous flying spacecraft according to claim 1, characterized in that: The system software of the central computer enters the safe configuration mode, and various important status parameters are set accordingly, specifically: Do not read important data from the lower computer; the state parameters are set as follows: Thermal control software enable / disable, energy software enable / disable, control software enable / disable, default satellite time, FDIR enable / disable, autonomous flight enable / disable, the communication status table with each lower device uses the master copy by default, the orbit mark defaults to the transfer orbit, the central computer cannot write to the main backup FLASH, and the entire satellite remote control defaults to the bright state.

5. The power-on initialization method of a fully autonomous flying spacecraft according to claim 3, characterized in that: The system software of the central computer enters the reset cutting mode, and when various important status parameters are set accordingly, the central computer reads the important data stored in the lower computer, and accordingly overwrites various status parameters of the system software.

6. The power-on initialization method of a fully autonomous flying spacecraft according to claim 1, characterized in that: The system software of the central computer enters the whole satellite power-off mode. When setting various important status parameters based on this, the status setting is based on safety. Specifically: The thermal control software is configured in minimum energy mode, the energy software is configured in minimum mode, and the control system software enters the solar orientation mode; Autonomous flight enable and disable, autonomous establishment of communication status table with each lower computer, central computer write enable to main backup FLASH, and whole satellite remote control setting clear state; Restore important data recorded in its own FLASH, star time, FDIR enable, and orbit mark from FLASH.

7. The power-on initialization method of a fully autonomous flying spacecraft according to claim 1, characterized in that: The system software of the central computer enters the whole satellite power-off and important data invalid mode, and various important status parameters are set accordingly, specifically: The thermal control software is configured in minimum energy mode, the energy software is configured in minimum mode, and the control system software enters the sun-orientation mode; The satellite time is set to the default satellite time, FDIR is enabled or disabled, autonomous flight is enabled or disabled, the orbit mark is set to transfer orbit, the central computer is enabled to write to the main backup FLASH, and the whole satellite remote control is set to the bright state; The communication between the central computer and the lower computer is carried out by autonomously establishing the link result.

Images